diff mbox

[FFmpeg-devel,1/3] avformat/nsvdec: Fix DoS due to lack of eof check in nsvs_file_offset loop.

Message ID 20170829232027.32431-1-michael@niedermayer.cc
State Accepted
Commit c24bcb553650b91e9eff15ef6e54ca73de2453b7
Headers show

Commit Message

Michael Niedermayer Aug. 29, 2017, 11:20 p.m. UTC 
From: 孙浩(晓黑) <tony.sh@alibaba-inc.com>

Fixes: 20170829.nsv

Co-Author: 张洪亮(望初)" <wangchu.zhl@alibaba-inc.com>
Found-by: Xiaohei and Wangchu from Alibaba Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavformat/nsvdec.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

Comments

Michael Niedermayer Aug. 31, 2017, 11:46 p.m. UTC | #1 
On Wed, Aug 30, 2017 at 01:20:25AM +0200, Michael Niedermayer wrote:
> From: 孙浩(晓黑) <tony.sh@alibaba-inc.com>
> 
> Fixes: 20170829.nsv
> 
> Co-Author: 张洪亮(望初)" <wangchu.zhl@alibaba-inc.com>
> Found-by: Xiaohei and Wangchu from Alibaba Security Team
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavformat/nsvdec.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)

patchset applied

[...]
diff mbox

Patch

diff --git a/libavformat/nsvdec.c b/libavformat/nsvdec.c
index c6ddb67bbd..d8ce656817 100644
--- a/libavformat/nsvdec.c
+++ b/libavformat/nsvdec.c
@@ -335,8 +335,11 @@  static int nsv_parse_NSVf_header(AVFormatContext *s)
         if (!nsv->nsvs_file_offset)
             return AVERROR(ENOMEM);
 
-        for(i=0;i<table_entries_used;i++)
+        for(i=0;i<table_entries_used;i++) {
+            if (avio_feof(pb))
+                return AVERROR_INVALIDDATA;
             nsv->nsvs_file_offset[i] = avio_rl32(pb) + size;
+        }
 
         if(table_entries > table_entries_used &&
            avio_rl32(pb) == MKTAG('T','O','C','2')) {